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Disclaimer 



The views and opinions expressed here are 
those of Craig Balding only and in no way 

represent the views, positions or opinions - 
expressed or implied - of my employer or 

anyone else. 




Global Tech Security Lead @F500 
> UNIX, Pen-Test, Incident Response 
Other blog.SecurityWannabe.com 
EuroTrash Security Podcast (Full crew here!) 
More @ cloudsecurity.org/about 







Do you use cloud storage? 

Have you booted a cloud compute 
instance in a public cloud? 

Have you played with cloud network 
overlays? 
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AIRLOCK MODULE 



MULTIPLE DOCKING ADAPTER 
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Get Practical 



Home Server RIP 
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Testing new/updated tools 

Software N IDS/NIPS 
testing 





It ' ^W 




r at 



Exploit testing 



WSSBBK-- 

H - Hi v. 

■■'-■■.''".•"•'••■•■■ ••:',''■■"'•'"'' ' 






Use cases 




■ 









Use cases 





lie 


CI 


E 


^BB 




IPURB Jl 


etv 


H5j 


rl 


dng 


IM 


Black Box 








One NIC PerVM 
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Basic Firewalls 
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Use cases 



An overlay network is a computer network 
which is built on top of another network. 
Nodes in the overlay can be thought of as 
being connected by virtual or logical links, 
each of which corresponds to a path, 
perhaps through many physical links, in the 
underlying network 



Use cases 
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Amazon S3 
API endpoint 



VPN 
Gateway 



VPN 
connection 
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Amazon recently opened up their Virtual Private Cloud, currently beta 

This is a cloud provider specific network overlay 

Hook up your existing network. Software VPN on your side, Hardware on their side 

All traffic traverses the customer gateway - no Internet access from within VPC 

Can use existing AMIs and Elastic Block Storage 



Amazon rapidly innovating - keep up with release details! 



Encrypted 
communication 



Virtual Servers 




VPN -Cubed Managers synchronize state and 
management information across N managers 



The first overlay network service for the cloud market. 

Based on OpenVPN, uses CohesiveFT created VMs as cloud VPN endpoints 

Supports multicast. 

Cross connect clouds, extend your home/business network 

Supports Amazon EC2 and gogrid 



Cheap! 

x86 Only 

Scriptable 

On-demand 

Pay As You Go 

Simulate 2 Subnets 

Fast startup/shutdown 

Use existing public & paid AMIs 

Connect from anywhere (Securely!) 
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Written on September 21 , 2009 by Craig Balding 

Slides from my BruCon Talk: "The Belgian Beer Lovers Guide to Cloud 
Security" 

I've received some requests for the slides presentee at BruCON, so here they are As me slides 
are mostly cevc-id ottext, I've ircludec the speaker notes. The notes are not polished. he m ce treat 
accordingly ;-). To view in "Full Screen" mode click on the ico" at the bottom right of the slideshane 
emoed below and eiicK 'Fit to Height" to see tre "otes. 

RS If you weren't at BruCON, you missed an excellent security conference - strong cortent 
excellent organ isali on and facilities, friendly crowd. Thanks to Benny 4 crew for being excellent 
hosts! 



Latest 

Introducing the Sky lab Community Project 

Good Computhg and Security Conference 
SacureCloudZDIO 

Cloud Security Threats Survey 

The Global Security Challenge: Money and 
Mentorehip forRadica Cloud So curty Ideas 



Are You Trying to Pin the Tail on the Cloud 
Donkey? 
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The Independent Cloud Computing and Security Forum 









Hello Craig Balding 

Show unread posts since last visit. 
Show new replies to you- posts. 
March IS, 20lO r 07:00^07 pm 
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News: 

Welcome! Want to read forum posts in your favourite newsreader? 

Subscribe either to the main forum feed or individual forum RSS feeds, 
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Topic: Anyone going to SecureCloud 201 D next week (Read 62 times) 



Anyone going to Secured oud 201 next week 

* on: March Li, 2010,01:46:54 pm * 



* previous next * 

ADD POLL NOTIFY HA*K L\REAC SEND TM IS TOPIC PmWT 



Q Ouoto (X Modify Qn Removo ."£) Split Topic 



Hey 

If you're going to SecureCloud 2010 In Barcelona next week, lets grab a beer. 

I'm pretty excited about this one - it looks to be the first "proper" security conference on cloud. Hopefully not too much fluff! 

I'll be presenting on a new project eodenamed Skylab. If you already a heavy laaS user, you can stop reading now@. If not r you might find it 
helpful. I'm developing some cloud architectures/configurations for creating simple cloud hased test lahs using puhlic clouds. The idea is to be able to 
quickly stand up an ad-hoc test network, spin up virtual machines on different subnets for testing purposes. In my case, target practice for 
pen-testing. But also, patch testing and the like. In other words, its about security peeps using the cloud for security related stuff. 

On j ptrbundl note, this will nidke d n -l<j changg fur nc, 1 get d churns Lo yeek out ruLfiL" thdii bldUU cm dbuul "Jiu "lyh luvd ibsuu^ - . 

If you're not going, let me know if you have any question for any of the speakers - I don't mine nagging them ■ 



Recently created the cloud security forum - an independent hang out for IT and IT security 
people to discuss cloud security issues 

Topic areas out as per CSA security domains 

There's a dedicated forum for Skylab which I'll be posting to with progress updates. 



If you have suggestions for Skylab, please share with me there. 



